WP Manifestindependent plugin directory
manifest / ecommerce / hdwebmobile-simple-subscriptions

HDWebmobile Simple Subscriptions

Sell recurring/subscription products in WooCommerce. Subscription state is always plain scalar database columns -- this plugin never calls PHP's serialize()/unserialize() on any data, closing the exact object-injection vulnerability class found in a competing subscriptions plugin.

by htrxuan - Han Tran · github.com/htrxuan/hdwebmobile-simple-subscriptions · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/htrxuan/hdwebmobile-simple-subscriptions/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/htrxuan/hdwebmobile-simple-subscriptions ↗

Sell recurring subscription products -- renewal orders are generated on schedule, no card data ever stored.

Description

HDWebmobile Simple Subscriptions lets a merchant mark any simple product as a recurring subscription (renews every N days, weeks, months, or years). When a customer's order for that product is paid, a subscription record is created; from then on, a scheduled job automatically generates a new order at each renewal and emails the customer a link to pay it. Customers manage their own subscriptions (view status, cancel) from a new "Subscriptions" tab in My Account.

Why this plugin exists

A competing WooCommerce Subscriptions plugin had a PHP Object Injection vulnerability (CVE-2026-18391): with High-Performance Order Storage enabled, it called PHP's unserialize() on data without validating it first, and an unauthenticated attacker could supply a crafted serialized payload that instantiated a gadget-chain object from a bundled dependency -- remote code execution. This plugin closes that entire vulnerability class by construction, not by sanitizing the unserialize call more carefully:

  • This plugin never calls PHP's serialize() or unserialize() anywhere in its code, on any data, under any circumstance. There is nothing to feed a gadget chain because there is no deserialization step to attack.
  • Every piece of subscription state -- the renewal interval, the next renewal date, the status -- is stored as its own plain scalar database column (an integer, a date, a short string), never as a serialized blob in a text field.
  • Renewal orders are only ever created through WooCommerce's own trusted wc_create_order()/WC_Order API, the same as a real checkout would, never by hand-assembling order data.
  • This plugin never stores a customer's payment card or token at all. Renewals don't auto-charge -- they generate a new order and email the customer a secure link to pay it via WooCommerce's own checkout, the same way any other order would be paid.
  • A compare-and-swap update on the renewal date makes each billing cycle's renewal idempotent -- if the scheduled job is ever retried or overlaps itself, only one renewal order can ever be created for a given cycle, never a duplicate charge request.

Features

  • Mark any simple product as a subscription with a configurable interval (every N days/weeks/months/years)
  • Automatic subscription creation when a qualifying order is paid
  • A daily scheduled job (via WooCommerce's own Action Scheduler) creates renewal orders and emails customers a pay-now link
  • "Subscriptions" tab in My Account: customers see status and next renewal date, and can cancel any time
  • Admin subscriptions list under WooCommerce > HDWebmobile, with manual cancel/reactivate for customer service

Development

Standard WordPress plugin structure:

hdwebmobile-simple-subscriptions.php    Bootstrap
includes/class-hdsub-activator.php
includes/class-hdsub-admin.php
includes/class-hdsub-core.php
includes/class-hdsub-hub.php
includes/class-hdsub-myaccount.php
includes/class-hdsub-order.php
includes/class-hdsub-product.php
includes/class-hdsub-renewal.php
includes/class-hdsub-repository.php

Part of the HDWebmobile suite of focused, single-purpose WooCommerce plugins.

License

GPLv2 or later. See LICENSE.